Authentication unstable

[kyoshino]

Today we are getting dozens of 403 errors saying “Email link is invalid or has expired.” The event logs say “One-time token not found.”

I know it sometimes happens when connecting through a VPN, but it seems unrelated as another user is also experiencing the issue.

Please fix the issue ASAP. Thank you.

[nissimlavy]

This usually isn’t random.

In Supabase auth, “One-time token not found” almost always means the token was either:

• invalidated by a second auth request, or
• evaluated against a different env / anon key, or
• expired early due to clock skew or edge caching.

If this suddenly started happening for multiple users, I’d specifically check:

1. whether auth requests are going through a CDN/edge layer that could be caching callbacks
2. whether multiple magic links are being generated per login attempt
3. whether server time drift exists (especially in containers)

VPN can trigger it, but widespread reports usually point to infra or flow issues.